Network intrusion detection method and device, equipment, storage medium and program product

Abstract

The invention discloses a network intrusion detection method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring network traffic data to be processed; detecting the network flow data by adopting a pre-trained network intrusion detection model to obtain a network intrusion result; wherein the network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine through a pre-constructed sample set, and the sample set is obtained by performing data enhancement on abnormal samples subjected to network intrusion through a synthetic minority class oversampling algorithm based on distance weight; the problem of unbalanced data sets can be effectively solved, meanwhile, the selection problem of kernel functions can be avoided, and the network intrusion detection performance of the model is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network intrusion detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the continuous development of network communication technology, network communication has penetrated into key aspects of various fields. At the same time, network threats are becoming increasingly diverse and complex, posing higher demands on network security. Intrusion Detection Systems (IDS) can identify abnormal patterns and traffic, and are widely used to combat network intrusions, representing an important research direction in the field of network security. Currently, anomaly-based IDS typically employ unsupervised detection methods, learning the characteristics of normal / abnormal network or system activity to detect network intrusion behaviors.

[0003] Currently, Multi-Class Support Vector Machines (MC-SVMs) are widely used in network intrusion detection due to their excellent high-dimensional data processing capabilities, strong versatility, robustness, and high computational efficiency. However, traditional MC-SVMs are highly dependent on the training data, but network intrusion datasets are often imbalanced, with a significant difference in the number of normal and abnormal samples. This leads to insufficient feature learning by MC-SVMs for anomalous attack data, affecting the accuracy of network intrusion detection. Summary of the Invention

[0004] To address the problems existing in the prior art, embodiments of the present invention provide a network intrusion detection method, apparatus, device, storage medium, and program product, which can effectively solve the problem of imbalanced datasets and improve the accuracy of network intrusion detection.

[0005] In a first aspect, embodiments of the present invention provide a network intrusion detection method, comprising: Acquire network traffic data to be processed; A pre-trained network intrusion detection model is used to detect the network traffic data to obtain network intrusion results; The network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine with a pre-constructed sample set. The sample set is obtained by using a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples that have suffered network intrusion.

[0006] As an improvement to the above solution, the method further includes: The pre-collected network traffic samples are classified and labeled to obtain abnormal samples carrying intrusion type labels and normal samples carrying normal type labels. Based on the sample imbalance ratio between the abnormal samples and the normal samples, a distance-weighted synthetic minority class oversampling algorithm is used to augment the abnormal samples to increase the number of abnormal samples. The sample set is constructed based on the expanded abnormal samples and the normal samples.

[0007] As an improvement to the above scheme, the step of using a distance-weighted synthetic minority class oversampling algorithm to augment the abnormal samples based on the sample imbalance ratio between the abnormal samples and the normal samples, in order to increase the number of abnormal samples, includes: For each anomalous sample, the Euclidean distance between the anomalous sample and other samples is calculated, and several other samples ranked at the top of the Euclidean distance are selected as the neighbor samples of the anomalous sample; wherein, the other samples include other anomalous samples besides the anomalous sample and normal samples; The sampling ratio is determined based on the sample imbalance ratio between the abnormal samples and the normal samples; Randomly select a neighboring sample from the neighboring samples, and calculate the Euclidean distance between the currently selected neighboring sample and the abnormal sample; A new abnormal sample is synthesized based on the abnormal sample, the Euclidean distance, the difference vector between the currently selected neighboring sample and the abnormal sample; From the neighboring samples, another neighboring sample is randomly selected to synthesize a new anomalous sample, until the number of newly synthesized anomalous samples reaches the sampling multiple.

[0008] As an improvement to the above scheme, the training process of the network intrusion detection model includes: Normalize each abnormal sample and each normal sample in the sample set. For each of the abnormal samples and each of the normal samples in the normalized sample set, median centering is performed. Based on the sample set centered by median, construct a centralized multi-kernel multi-class support vector machine; Based on the normalized sample set, the parameters of the centralized multi-core multi-class support vector machine are tuned using a Bayesian optimization algorithm to obtain a trained network intrusion detection model.

[0009] As an improvement to the above scheme, the median-centered processing of each of the abnormal samples and each of the normalized samples in the normalized sample set includes: The median of the normalized sample set is calculated according to the sample feature dimensions to obtain the median under multiple sample feature dimensions. Based on the median of each sample feature dimension, the sample feature value of each sample in the sample set is centered in the corresponding sample feature dimension.

[0010] As an improvement to the above scheme, the step of constructing a centralized multi-kernel multi-class support vector machine based on the sample set centered by the median includes: Based on the sample set after median-centered processing, calculate the kernel matrix of multiple different kernel functions; wherein, the kernel functions include linear kernel function, Gaussian kernel function and logistic kernel function; A combined kernel function is generated by linearly combining multiple kernel matrices. The combined kernel function is used as the kernel function of the multi-class support vector machine to construct the centralized multi-kernel multi-class support vector machine, and the parameters of the centralized multi-kernel multi-class support vector machine are initialized.

[0011] Secondly, embodiments of the present invention provide a network intrusion detection device, comprising: The data acquisition module is used to acquire network traffic data to be processed; The intrusion detection module is used to detect the network traffic data using a pre-trained network intrusion detection model to obtain network intrusion results; The network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine with a pre-constructed sample set. The sample set is obtained by using a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples that have suffered network intrusion.

[0012] Thirdly, embodiments of the present invention provide a network intrusion detection device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the network intrusion detection method as described in any one of the first aspects.

[0013] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network intrusion detection method as described in any one of the first aspects.

[0014] Fifthly, embodiments of the present invention provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the network intrusion detection method as described in any one of the first aspects.

[0015] Compared to existing technologies, this invention provides a network intrusion detection method, apparatus, device, storage medium, and program product. It acquires network traffic data to be processed and then uses a pre-trained network intrusion detection model to detect the network traffic data, obtaining network intrusion results. The network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine using a pre-constructed sample set. The sample set is obtained by using a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples that have suffered network intrusions. This invention effectively solves the problem of imbalanced datasets and improves the accuracy of network intrusion detection. Attached Figure Description

[0016] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a network intrusion detection method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall process of network intrusion detection provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of a network intrusion detection device provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a network intrusion detection device provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It is understood that the various numerical designations used in the embodiments of this invention are merely for descriptive convenience and are not intended to limit the scope of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0020] In embodiments of the invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element. The term "a plurality or several" refers to two or more.

[0021] See Figure 1 , Figure 1 This is a flowchart of a network intrusion detection method provided in an embodiment of the present invention. The network intrusion detection method specifically includes: S11: Obtain network traffic data to be processed; S12: The network traffic data is detected using a pre-trained network intrusion detection model to obtain network intrusion results; The network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine with a pre-constructed sample set. The sample set is obtained by using a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples that have suffered network intrusion.

[0022] This invention collects network traffic samples that have been subjected to network intrusion (i.e., those subjected to abnormal network attacks) as anomalous samples, and network traffic samples that have not been subjected to network intrusion (i.e., those not subjected to abnormal network attacks) as normal samples. Considering that the number of anomalous samples is far less than the number of normal samples, belonging to the minority class, this invention employs a distance-weighted synthetic minority class oversampling algorithm to augment the anomalous samples (also known as minority class samples) to increase their number, thus balancing the number of anomalous samples with the number of normal samples (also known as majority class samples) and solving the imbalanced dataset problem. Specifically, in the distance-weighted synthetic minority class oversampling algorithm, Euclidean distance between samples can replace the random numbers in the original synthetic minority class oversampling algorithm as weights for synthesizing new samples.

[0023] Then, a sample set is constructed based on the expanded abnormal and normal samples. A pre-built centralized multi-core multi-class support vector machine is then trained on this model. For example, Bayesian optimization algorithms are used to fine-tune the parameters of the centralized multi-core multi-class support vector machine to obtain a trained network intrusion detection model. Subsequently, the network traffic data to be detected can be input into the trained network intrusion detection model to perform network intrusion detection and obtain network intrusion results, such as detecting abnormal network attacks or not detecting abnormal network attacks; thus, the accuracy of network intrusion detection can be effectively improved.

[0024] Furthermore, the method also includes: The pre-collected network traffic samples are classified and labeled to obtain abnormal samples carrying intrusion type labels and normal samples carrying normal type labels. Based on the sample imbalance ratio between the abnormal samples and the normal samples, a distance-weighted synthetic minority class oversampling algorithm is used to augment the abnormal samples to increase the number of abnormal samples. The sample set is constructed based on the expanded abnormal samples and the normal samples.

[0025] For example, the process of constructing a sample set is as follows: First, the collected network traffic samples are classified to identify those with abnormal network attacks and those without. The network traffic samples with abnormal network attacks are labeled with tags indicating the type of intrusion, while the network traffic samples without abnormal network attacks are labeled with tags indicating the type of normal network traffic.

[0026] Then, dimensionality reduction is performed on the above normal and abnormal samples. For example, PCA (Principal Component Analysis) algorithm is used to reduce the dimensionality of each sample (including normal and abnormal samples) to avoid the unreliability of distance-based measures between high-dimensional data samples, reduce dimensionality differences and reduce the amount of computation in subsequent processing.

[0027] Then, the DW-SMOTE (Dinstance Weight - Synthetic Minority Over-sampling Technique) algorithm was used to augment and expand the abnormal samples (i.e. minority samples) after the above processing, generating a sample set and eliminating the imbalance of the dataset.

[0028] Specifically, the step of using a distance-weighted synthetic minority class oversampling algorithm to augment the abnormal samples based on the sample imbalance ratio between the abnormal samples and the normal samples, in order to increase the number of abnormal samples, includes: For each anomalous sample, the Euclidean distance between the anomalous sample and other samples is calculated, and several other samples ranked at the top of the Euclidean distance are selected as the neighbor samples of the anomalous sample; wherein, the other samples include other anomalous samples besides the anomalous sample and normal samples; The sampling ratio is determined based on the sample imbalance ratio between the abnormal samples and the normal samples; Randomly select a neighboring sample from the neighboring samples, and calculate the Euclidean distance between the currently selected neighboring sample and the abnormal sample; A new abnormal sample is synthesized based on the abnormal sample, the Euclidean distance, the difference vector between the currently selected neighboring sample and the abnormal sample; From the neighboring samples, another neighboring sample is randomly selected to synthesize a new anomalous sample, until the number of newly synthesized anomalous samples reaches the sampling multiple.

[0029] For example, the specific process of using a distance-weighted synthetic minority class oversampling algorithm to augment and expand the abnormal samples is as follows: Calculate K-nearest neighbors: for each outlier sample (i.e., a minority class sample) Calculate outlier samples Other samples (excluding those in the sample set) The Euclidean distance between the abnormal sample and the normal sample (excluding other abnormal samples) is selected. The K nearest samples are considered as neighbors; for example, other samples are sorted in ascending order of Euclidean distance, and the K samples at the top of the sort are selected as neighbors, i.e., nearby samples.

[0030] Confirm the sampling ratio: Based on the sample imbalance ratio, set the sampling ratio N to determine the number of samples needed to be generated for each anomalous sample. The sampling ratio N indicates the number of new anomalous samples to be synthesized for each anomalous sample. For example, if the original number of anomalous samples is 3M, the number of normal samples is 7M, the sample imbalance ratio is 3:7, and the target ratio of anomalous samples to normal samples is 1:1, then the sampling ratio N can be set to (7M-3M) / 3M, ensuring that the total number of newly synthesized anomalous samples and the original anomalous samples is consistent with the number of normal samples. In other embodiments, data augmentation and expansion can be performed simultaneously on both anomalous and normal samples, or other target ratios can be set. The specific principles of data augmentation and expansion are the same and will not be repeated here.

[0031] Synthesize new samples: For each anomalous sample N samples are randomly selected from its K nearest neighbors; specifically, assume that one of the randomly selected neighbors is... Generate new abnormal samples The specific calculation formula is as follows: (1); Where rand_val represents the nearest neighbor sample with abnormal samples Distance weights between samples can be based on neighboring samples. with abnormal samples Euclidean distance between The calculations show that i = 1, 2, ..., N. Indicates sample and The difference vector between them.

[0032] Among them, each neighboring sample The distance weights are based on the corresponding neighboring samples. with abnormal samples Euclidean distance between and all neighboring samples with abnormal samples Euclidean distance between The calculation is as follows: (2); in, This represents Euler's constant, with a value of 0.5772156649, to avoid the risk of calculation errors due to a numerator of 0.

[0033] In other embodiments, neighboring samples with abnormal samples The distance weight rand_val can also be a random number between 0 and 1, i.e., a random weight.

[0034] Repeating the above process N times will identify the abnormal sample. Generate N new abnormal samples .

[0035] Repeat the above process for each anomalous sample in the sample set until a sufficient number of anomalous samples are generated.

[0036] Random weights lack interpretability and scientific validity. Furthermore, some samples may be more representative. Therefore, this proposal suggests a distance weight to optimize the calculation of synthetic samples.

[0037] This invention uses Euclidean distance to calculate distance weights instead of random weights, taking into account individual differences between samples. This allows newly synthesized outlier samples to better maintain the local data structure of the original minority class. It helps avoid generating meaningless or even harmful samples in areas with blurred class boundaries or near noise points, making sample generation more scientifically based.

[0038] Furthermore, the training process of the network intrusion detection model includes: Normalize each abnormal sample and each normal sample in the sample set. For each of the abnormal samples and each of the normal samples in the normalized sample set, median centering is performed. Based on the sample set centered by median, construct a centralized multi-kernel multi-class support vector machine; Based on the normalized sample set, the parameters of the centralized multi-core multi-class support vector machine are tuned using a Bayesian optimization algorithm to obtain a trained network intrusion detection model.

[0039] For example, the samples in the sample set constructed above (including abnormal samples and normal samples) are normalized using the standardized variable algorithm (Z-score).

[0040] Then, the samples in the normalized sample set are centered by median balancing to construct a centralized multi-kernel multi-class support vector machine. The kernel function in this centralized multi-kernel multi-class support vector machine is constructed based on kernel matrices of various different kernel functions, such as kernel matrices based on linear kernel functions, Gaussian kernel functions, and logistic kernel functions.

[0041] Subsequently, based on the normalized sample set, the centralized multi-core multi-class support vector machine is trained using the Bayesian optimization algorithm to optimize its parameters until the centralized multi-core multi-class support vector machine reaches a preset stopping iteration condition, such as when the accuracy improvement of the centralized multi-core multi-class support vector machine is less than a set accuracy threshold (e.g., 0.1%) after the training count reaches the maximum number of iterations or after a set number of consecutive iterations (e.g., 10 times), the training stops, and the trained network intrusion detection model is obtained.

[0042] Furthermore, the samples in the normalized sample set (including normal and abnormal samples) can be divided into a training set and a test set according to a set ratio (e.g., 7:3). The training set is used for training the centralized multi-core multi-class support vector machine model, and the test set is used for validating the trained centralized multi-core multi-class support vector machine model.

[0043] like Figure 2 As shown, this embodiment of the invention employs a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples, eliminating dataset imbalance and ensuring that the centralized multi-kernel multi-class support vector machine can fully learn the feature information of normal and intrusive samples, thereby improving accuracy. The median-centered method is used to construct the kernel function of the centralized multi-kernel multi-class support vector machine, which integrates multiple kernel functions, eliminating or reducing the negative impact of sample noise on the model and improving its generalizability. Bayesian optimization is used to tune the important parameters of the model, thereby improving model performance.

[0044] Specifically, the median-centered processing of each of the abnormal samples and each of the normal samples in the normalized sample set includes: The median of the normalized sample set is calculated according to the sample feature dimensions to obtain the median under multiple sample feature dimensions. Based on the median of each sample feature dimension, the sample feature value of each sample in the sample set is centered in the corresponding sample feature dimension.

[0045] For example, the process of centering the median of the normalized sample set is as follows: Calculating the median: For each feature dimension of the sample set, calculate the median separately to obtain the median under each feature dimension. Let the set of medians obtained be [m1, m2, ..., m]. d ], where d is the dimension of the sample features in the sample set; for example, let the sample set be S={x1, x2, ..., x... T}, where each sample x t =[x t1 x t2 ,..,xtd ], T represents the total number of samples in the sample set. This is achieved by analyzing the sample feature values ​​(e.g., x) under a specific feature dimension for each sample. 11 x 21 x t1 ...x T1 Sort the samples in ascending or descending order, and obtain the median m1 of the samples at the middle position of the sorted position. Repeat this process to obtain the medians for d sample feature dimensions, such as m1, m2, ..., m... d .

[0046] Median centering: For each sample x in the sample set t For each sample feature dimension j, the sample feature value x tj Centralization ,in, , Then each sample after centering is The centralized sample set is .

[0047] The embodiments of the present invention can achieve feature scale uniformity, avoid weight bias, and improve data quality and stability by performing median centering on the samples.

[0048] Specifically, the step of constructing a centralized multi-kernel multi-class support vector machine based on the sample set centered by median includes: Based on the sample set after median-centered processing, calculate the kernel matrix of multiple different kernel functions; wherein, the kernel functions include linear kernel function, Gaussian kernel function and logistic kernel function; A combined kernel function is generated by linearly combining multiple kernel matrices. The combined kernel function is used as the kernel function of the multi-class support vector machine to construct the centralized multi-kernel multi-class support vector machine, and the parameters of the centralized multi-kernel multi-class support vector machine are initialized.

[0049] For example, based on the sample set centered by the median, kernel matrices for multiple different kernel functions are calculated; in this embodiment of the invention, a linear kernel, a Gaussian kernel, and a sigmoid kernel are selected to construct a combined kernel function. Let the centered kernel matrices obtained by the linear kernel, Gaussian kernel, and sigmoid kernel be respectively... , and The kernel matrix is ​​a... A symmetric matrix, where the element in the a-th row and b-th column of the kernel matrix represents the sample in the sample set. and samples The inner product in the feature space, .

[0050] Constructing combined kernel functions: Based on the above calculations, obtain the kernel matrices for linear kernel functions, Gaussian kernel functions, and logistic kernel functions. , , The linear combination yields a centered combinatorial kernel function, calculated using the following formula: (3); in, The weights of the kernel function are represented by k = 1, 2, 3, and . As a hyperparameter, it is optimized using a Bayesian optimization algorithm in subsequent steps.

[0051] Use the obtained centralized combined kernel function As the kernel function of MC-SVM, a centralized multi-kernel MC-SVM is constructed, and the parameters of the centralized multi-kernel MC-SVM are initialized, including the width coefficient of the Gaussian kernel function, the scaling factor and bias of the logistic kernel function, and the weights of the kernel function. Initialize parameters such as the penalty coefficient, and set the maximum number of iterations, for example, 300.

[0052] Based on the initial parameters described above, the initial parameters and configuration of the Bayesian algorithm are set. The value range of these initial parameters is defined within the Bayesian algorithm, and the accuracy of the centralized multi-core MC-SVM detection is set as the objective function of the Bayesian algorithm. Within the parameter value range, different combinations of parameter values ​​are used to train the centralized multi-core MC-SVM. The centralized multi-core MC-SVM training uses the normalized sample set described above as the training set. The specific training process is existing technology and will not be detailed here.

[0053] When the accuracy improvement is less than 0.1% after reaching the maximum number of iterations or the set number of consecutive iterations (e.g., 10 times), training is stopped, the model performance (e.g., accuracy, precision, recall) is evaluated, and the model performance evaluation results are fed back to the Bayesian optimization algorithm.

[0054] Based on the model performance evaluation results under different parameter combinations, the parameter combination with the best model performance evaluation results (such as the highest accuracy, highest precision, and high recall) is selected as the final parameter of the centralized multi-core MC-SVM to construct the network intrusion detection model.

[0055] The embodiments of this invention employ the Bayesian optimization algorithm to perform hyperparameter tuning on important parameters of the model (the width coefficient of the Gaussian kernel function, the scaling factor and bias of the logistic kernel function, the kernel weights, and the penalty coefficient), which can effectively improve the model training efficiency and model performance.

[0056] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows: The distance weights constructed based on the Euclidean distance of the samples replace the original random weights, resulting in a synthetic minority oversampling algorithm based on distance weights. This algorithm is used to augment and expand minority class samples. On the one hand, it can eliminate the imbalance of the dataset, and on the other hand, it fully considers the differences between different samples. It has higher computational efficiency and flexibility, and is less sensitive to noise. This ensures that the network intrusion detection model built on centralized multi-core MC-SVM can fully learn the feature information of normal samples and intrusion samples, thereby improving the accuracy of network abnormal traffic detection.

[0057] A linear combination kernel function was constructed using the median centering method, which eliminates or reduces the negative impact of sample noise on MC-SVM and can optimize model performance. Bayesian optimization is used to perform hyperparameter tuning on the important parameters of the model (the width coefficient of the Gaussian kernel function, the scaling factor and bias of the logistic kernel function, the kernel weights, and the penalty coefficient), so that the centralized multi-kernel MC-SVM can be applied to datasets with different characteristics and scenarios, making the model more versatile and further improving the model performance.

[0058] See Figure 3 , Figure 3 This is a structural block diagram of a network intrusion detection device provided in an embodiment of the present invention. The network intrusion detection device includes: Data acquisition module 11 is used to acquire network traffic data to be processed; Intrusion detection module 12 is used to detect the network traffic data using a pre-trained network intrusion detection model to obtain network intrusion results; The network intrusion detection model is obtained by training a centralized multi-core multi-class support vector machine with a pre-constructed sample set. The sample set is obtained by using a distance-weighted synthetic minority class oversampling algorithm to augment abnormal samples that have suffered network intrusion.

[0059] In an optional embodiment, the device further includes: The classification and labeling module is used to classify and label pre-collected network traffic samples to obtain abnormal samples carrying intrusion type labels and normal samples carrying normal type labels. The data augmentation module is used to augment the abnormal samples by employing a distance-weighted synthetic minority class oversampling algorithm based on the sample imbalance ratio between the abnormal samples and the normal samples, so as to increase the number of abnormal samples. The sample set construction module is used to construct the sample set based on the expanded abnormal samples and the normal samples.

[0060] In one optional embodiment, the data enhancement module includes: The nearest neighbor determination unit is used to calculate the Euclidean distance between the abnormal sample and other samples for each abnormal sample, and select several other samples that rank at the top of the Euclidean distance in ascending order as the neighbor samples of the abnormal sample; wherein, the other samples include other abnormal samples besides the abnormal sample and normal samples; A sampling rate determination unit is used to determine the sampling rate based on the sample imbalance ratio between the abnormal samples and the normal samples; The Euclidean distance calculation unit is used to randomly select a neighboring sample from the neighboring samples and calculate the Euclidean distance between the currently selected neighboring sample and the abnormal sample; The sample synthesis unit is used to synthesize new abnormal samples based on the abnormal sample, the Euclidean distance, the difference vector between the currently selected neighboring sample and the abnormal sample, and to randomly select a neighboring sample from the neighboring samples again to synthesize new abnormal samples, until the number of newly synthesized abnormal samples reaches the sampling rate.

[0061] In an optional embodiment, the device further includes: The normalization module is used to normalize each abnormal sample and each normal sample in the sample set; The median centering module is used to perform median centering on each of the abnormal samples and each of the normal samples in the normalized sample set. The centralized multi-core multi-class support vector machine construction module is used to construct a centralized multi-core multi-class support vector machine based on the sample set after median centralization. The parameter tuning module is used to perform parameter tuning on the centralized multi-core multi-class support vector machine based on the Bayesian optimization algorithm according to the normalized sample set, so as to obtain a trained network intrusion detection model.

[0062] In one optional embodiment, the median centralization processing module includes: The median calculation unit is used to calculate the median of the normalized sample set according to the sample feature dimensions, and obtain the median under multiple sample feature dimensions. The centralization unit is used to centralize the sample feature value of each sample in the sample set according to the median of each sample feature dimension.

[0063] In one optional embodiment, the centralized multi-core multi-class support vector machine construction module includes: The kernel matrix calculation unit is used to calculate the kernel matrix of multiple different kernel functions based on the sample set after median-centered processing; wherein the kernel functions include linear kernel function, Gaussian kernel function and logical kernel function; A combined kernel function generation unit is used to linearly combine multiple kernel matrices to generate a combined kernel function. The support vector machine construction unit is used to construct the centralized multi-kernel multi-class support vector machine by using the combined kernel function as the kernel function of the multi-class support vector machine, and to initialize the parameters of the centralized multi-kernel multi-class support vector machine.

[0064] It should be noted that the working process of each module in the network intrusion detection device described in the embodiments of the present invention can refer to the working process of the network intrusion detection method described in the above embodiments, and the technical effect achieved is the same as that of the network intrusion detection method described in the above embodiments, so it will not be repeated here.

[0065] See Figure 4 , Figure 4 This is a structural block diagram of a network intrusion detection device provided in an embodiment of the present invention. The network intrusion detection device includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the above-described network intrusion detection method embodiments, such as steps S11 to S12.

[0066] For example, the computer program may be divided into one or more modules or units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules or units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the network intrusion detection device.

[0067] The network intrusion detection device may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of a network intrusion detection device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the network intrusion detection device may also include input / output devices, network access devices, buses, etc.

[0068] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the network intrusion detection device, connecting various parts of the device via various interfaces and lines.

[0069] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the network intrusion detection device by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0070] If the modules or units integrated into the network intrusion detection device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0071] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0072] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network intrusion detection method, characterized by, The method comprises: acquiring network traffic data to be processed; detecting the network traffic data by using a pre-trained network intrusion detection model to obtain a network intrusion result; wherein the network intrusion detection model is obtained by training a centralized multi-kernel multi-class support vector machine by a pre-constructed sample set, and the sample set is obtained by data enhancement on abnormal samples subjected to network intrusion by using a distance weight-based synthetic minority over-sampling technique (SMOTE).

2. The network intrusion detection method of claim 1, wherein, The method further comprises: classifying and labeling pre-acquired network traffic samples to obtain abnormal samples carrying intrusion type labels and normal samples carrying normal type labels; according to a sample imbalance ratio between the abnormal samples and the normal samples, performing data enhancement on the abnormal samples by using a distance weight-based SMOTE to expand the number of the abnormal samples; constructing the sample set according to the expanded abnormal samples and the normal samples.

3. The network intrusion detection method of claim 2, wherein, The method of performing data enhancement on the abnormal samples by using the distance weight-based SMOTE to expand the number of the abnormal samples according to the sample imbalance ratio between the abnormal samples and the normal samples comprises: for each abnormal sample, calculating the Euclidean distance between the abnormal sample and other samples, and selecting a plurality of other samples in the front row according to the order from small to large of the Euclidean distance as neighboring samples of the abnormal sample; wherein the other samples include other abnormal samples and normal samples except the abnormal sample; determining a sampling rate according to the sample imbalance ratio between the abnormal samples and the normal samples; randomly selecting one neighboring sample from the neighboring samples and calculating the Euclidean distance between the selected neighboring sample and the abnormal sample; synthesizing a new abnormal sample according to the abnormal sample, the Euclidean distance, and the difference vector between the selected neighboring sample and the abnormal sample; randomly selecting one neighboring sample from the neighboring samples to synthesize a new abnormal sample until the number of the synthesized abnormal samples reaches the sampling rate.

4. The network intrusion detection method of claim 1, wherein, The training process of the network intrusion detection model comprises: performing normalization processing on each abnormal sample and each normal sample in the sample set; performing median centering processing on each abnormal sample and each normal sample in the normalized sample set; constructing a centralized multi-kernel multi-class support vector machine according to the median centered sample set; performing parameter tuning of the centralized multi-kernel multi-class support vector machine based on a Bayesian optimization algorithm according to the normalized sample set to obtain a trained network intrusion detection model.

5. The network intrusion detection method of claim 4, wherein, The method of performing median centering processing on each abnormal sample and each normal sample in the normalized sample set comprises: performing median calculation on the normalized sample set according to sample feature dimensions to obtain medians in multiple sample feature dimensions; centering sample feature values of each sample in the corresponding sample feature dimension in the sample set according to the medians in the sample feature dimensions.

6. The network intrusion detection method of claim 4, wherein, The method comprises the following steps: According to the sample set processed by the median centering, a plurality of kernel matrices of different kernel functions are calculated; wherein, the kernel functions include linear kernel function, Gaussian kernel function and logic kernel function; Linear combination is performed on the plurality of kernel matrices to generate a combined kernel function; The combined kernel function is used as the kernel function of the multi-class support vector machine to construct the centralized multi-kernel multi-class support vector machine, and the centralized multi-kernel multi-class support vector machine is parameterized.

7. A network intrusion detection apparatus, characterized by comprising: It comprises: A data acquisition module is configured to acquire network traffic data to be processed; An intrusion detection module is configured to detect the network traffic data by using a pre-trained network intrusion detection model to obtain a network intrusion result; The network intrusion detection model is obtained by training a centralized multi-kernel multi-class support vector machine by using a sample set, and the sample set is obtained by using a distance weight-based synthetic minority over-sampling technique (SMOTE) to perform data enhancement on abnormal samples subjected to network intrusion.

8. A network intrusion detection device, characterized by It comprises: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the network intrusion detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program controls the device where the computer readable storage medium is located to execute the network intrusion detection method according to any one of claims 1 to 6 when the computer program is running.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the network intrusion detection method according to any one of claims 1 to 6.

Images